RE: Snort 2.0 as a Windows Service??

["Michael Steele" <michaels () silicondefense com>]

Erek,

How can you tell he has two output database plugins?

In my documentation it specifies two output database lines. 0ne is alert
and the other is log.

If he is using my docs, leave in both line, but make sure the syntax is
correct. I'm assuming he has failed to properly setup the users in the
database.

He can also execute his run line with a -T at the end but most likely
won't get much more information. He can also check the Application log
and see what it's reporting. 

-Michael
-- 
 Michael Steele | System Engineer / Support Technician     
 mailto:michaels () silicondefense com    
 Silicon Defense - The Cyber-War Defense Company
 Website: http://www.silicondefense.com
 Snort: Open Source Network IDS - http://www.snort.org


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Erek Adams
Sent: Wednesday, April 23, 2003 6:24 AM
To: kerberos K
Cc: RussU () RP-L com; snort-users () lists sourceforge net
Subject: RE: [Snort-users] Snort 2.0 as a Windows Service??

On Tue, 22 Apr 2003, kerberos K wrote:

[...snip...]

> database: compiled support for ( mysql odbc )
> database: configured to use mysql
> database:          user = snort
> database: password is set
> database: database name = snort
> database:          host = 127.0.0.1
> database:          port = 3306
> database:   sensor name = Websrv15e
> database:     sensor id = 2
> database: schema version = 106
> database: using the "alert" facility
> database: compiled support for ( mysql odbc )
> database: configured to use mysql
> database:          user = snort
> database: database name = snort
> database:          host = 127.0.0.1
> database:          port = 3306
> database:   sensor name = Websrv15e
> ERROR: database: mysql_error: Access denied for user:
'snort@127.0.0.1'
> (Using password: NO)
> Fatal Error, Quitting..
>
> > From reading some of the archives, I suspect this is a a Mysql error.
Being
> a novice though, I'm curious as to how simply upgrading Snort would
affect
> my Database tables and permissions?? Also, reading Michael Steele's
> documentation on this (as well as how I configured it with 1.9.1), the
> service should be running prior to even configuring MySql...

You've got 2 db output plugin lines in your snort.conf.  Remove the
second
one and all should be well.  Use the one that has a password listed,
since
that's what the second seems to be failing on.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users